Probleme mit Windows 2000 Server

1. Problem:

Wenn der Server neu gestartet wird und ich mich als Administrator einlogge braucht dieser ca. 15 Minuten um den Login abzuschließen. Er bleibt ewig bei dem Punkt "Benutzereinstellungen werden übernommen hängen". Wie kann ich der Ursache auf den Grund gehen? In den Ereignissen konnte ich leider nix hilfreiches finden.

2. Problem:

Der Dienst "Druckerwarteschlange" wird öfters einfach beendet. Hierzu habe ich folgende drwtsn32 Log Dateien:

Anwendungsausnahme aufgetreten:
Anwendung: spoolsv.exe (pid=540)
Wann: 02.04.2008 @ 11:01:21.468
Ausnahmenummer: c0000005 (Zugriffsverletzung)

*----> Systeminformationen <----*
Computername: W2SERVER
Benutzername: SYSTEM
Prozessoranzahl: 4
Prozessortyp: x86 Family 15 Model 2 Stepping 7
Windows 2000-Version: 5.0
Aktuelles Build: 2195
Service Pack: 4
Aktueller Typ: Multiprocessor Free
Firma: *
Besitzer: *

*----> Taskliste <----*
0 Idle.exe
8 System.exe
196 smss.exe
220 CSRSS.exe
244 WINLOGON.exe
272 services.exe
284 lsass.exe
388 termsrv.exe
512 svchost.exe
540 SPOOLSV.exe
324 msdtc.exe
964 jsl.exe
976 dfssvc.exe
1024 ekrn.exe
1056 svchost.exe
1068 dbnt1sv.exe
1108 ismserv.exe
1120 LLSSRV.exe
1180 ntfrs.exe
1236 OPHGLDCS.exe
1272 regsvc.exe
1304 locator.exe
1316 mstask.exe
1360 snmp.exe
1400 stisvc.exe
1460 twwinsdr.exe
1500 lserver.exe
1544 ups.exe
1564 svchost.exe
1584 dns.exe
1968 svchost.exe
2236 explorer.exe
2336 egui.exe
2364 IWatch.exe
2372 WZQKPICK.exe
1200 CSRSS.exe
416 WINLOGON.exe
636 CSRSS.exe
1952 WINLOGON.exe
2916 javaw.exe
2224 CSRSS.exe
2844 WINLOGON.exe
2052 drwtsn32.exe
0 _Total.exe

(01000000 - 0100D000)
(77880000 - 77901000)
(78000000 - 78045000)
(77E70000 - 77F36000)
(79350000 - 793B2000)
(77D20000 - 77D91000)
(77F40000 - 77F7C000)
(77E00000 - 77E65000)
(76A40000 - 76A57000)
(74FA0000 - 74FB4000)
(74F90000 - 74F98000)
(750E0000 - 7512F000)
(79430000 - 7943F000)
(75130000 - 75136000)
(750C0000 - 750CF000)
(77940000 - 7796B000)
(77970000 - 77994000)
(74FC0000 - 74FC9000)
(77310000 - 77323000)
(774F0000 - 774F5000)
(772F0000 - 77307000)
(77A40000 - 77B37000)
(779A0000 - 77A3B000)
(77380000 - 773B0000)
(77350000 - 77373000)
(77820000 - 7782E000)
(78310000 - 783A1000)
(791A0000 - 79203000)
(774B0000 - 774E3000)
(77490000 - 774A1000)
(77500000 - 77522000)
(71710000 - 71794000)
(63180000 - 631E5000)
(77330000 - 77349000)
(777E0000 - 777E5000)
(770C0000 - 77102000)
(77810000 - 77817000)
(75940000 - 75946000)
(76920000 - 7693B000)
(67E80000 - 67F71000)
(777F0000 - 7780E000)
(782F0000 - 78301000)
(73350000 - 7335F000)
(10000000 - 1000E000)
(76F80000 - 7707B000)
(6C1D0000 - 6C1DE000)
(00DE0000 - 00DEC000)
(00DF0000 - 00E1F000)
(00E30000 - 00E58000)
(00E60000 - 00E6B000)
(00E70000 - 00E7A000)
(65410000 - 65417000)
(664A0000 - 664AA000)
(655B0000 - 655BD000)
(68910000 - 6891B000)
(77580000 - 777CE000)
(00E80000 - 00E87000)
(76A60000 - 76A67000)
(76A30000 - 76A3E000)
(76A20000 - 76A26000)
(00FD0000 - 00FDA000)
(01050000 - 0105A000)
(010E0000 - 010EE000)
(77830000 - 7783C000)
(777D0000 - 777D8000)
(74F40000 - 74F5E000)
(74F80000 - 74F87000)
(76A00000 - 76A1F000)
(784A0000 - 78526000)
(76AB0000 - 76AC3000)
(013C0000 - 01430000)
(68600000 - 6865F000)
(75DF0000 - 75E0A000)
(018E0000 - 018F1000)
(77BE0000 - 77BF1000)
(74F60000 - 74F73000)
(78280000 - 782B6000)
(76600000 - 7660E000)
(77400000 - 77410000)
(6A900000 - 6A9FD000)
(04490000 - 044AE000)
(09310000 - 093D1000)
(093E0000 - 093FA000)
(04920000 - 04952000)
(06A60000 - 06A74000)
(06A90000 - 06AAD000)

Statusabbild für Threadkennung 0x218

eax=00000000 ebx=00000000 ecx=02000101 edx=00000000 esi=00000000 edi=00000030
eip=7788c55d esp=0006fbf0 ebp=0006fc60 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000246


Funktion: ZwReadFile
7788c552 b8a1000000 mov eax,0xa1
7788c557 8d542404 lea edx,[esp+0x4] ss:00889ad7=00000000
7788c55b cd2e int 2e
7788c55d c22400 ret 0x24
7788c560 55 push ebp
7788c561 8bec mov ebp,esp
7788c563 8b550c mov edx,[ebp+0xc] ss:00889b46=00000000
7788c566 8b4a04 mov ecx,[edx+0x4] ds:00819ee6=00000000
7788c569 8b02 mov eax,[edx] ds:00000000=????????
7788c56b 8901 mov [ecx],eax ds:02000101=????????
7788c56d 894804 mov [eax+0x4],ecx ds:00819ee6=00000000
7788c570 8b4d08 mov ecx,[ebp+0x8] ss:00889b46=00000000
7788c573 3909 cmp [ecx],ecx ds:02000101=????????
7788c575 0f843e52ffff je RtlAppendAsciizToString+0x80 (778817b9)
7788c57b 3bc1 cmp eax,ecx

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
0006FC60 79360135 00000030 0006FD38 00000216 0006FC88 ntdll!ZwReadFile
0006FC8C 7935FFBB 00000030 0006FD38 00000216 0006FCC4 advapi32!StartServiceCtrlDispatcherW
0006FD08 7935FCCA 00000030 0006FD38 00000216 0006F944 advapi32!StartServiceCtrlDispatcherW
0006FF68 01001295 0100B030 01001265 00000001 002337F0 advapi32!StartServiceCtrlDispatcherW
0006FFC0 77E787F5 0006F944 778CC35C 7FFDF000 0000021A spoolsv!<nosymbols>
0006FFF0 00000000 01001170 00000000 000000C8 00000100 kernel32!DosDateTimeToFileTime

*----> Raw Stack Dump <----*
0006fbf0 0d 66 e7 77 30 00 00 00 - 00 00 00 00 00 00 00 00 .f.w0...........
0006fc00 00 00 00 00 38 fc 06 00 - 38 fd 06 00 16 02 00 00 ....8...8.......
0006fc10 00 00 00 00 00 00 00 00 - c4 fc 06 00 82 65 e7 77 .............e.w
0006fc20 38 fd 06 00 00 00 00 00 - 01 00 00 00 00 00 00 00 8...............
0006fc30 a5 5d 00 01 00 00 00 00 - c0 fb 06 00 01 01 00 02 .]..............
0006fc40 88 fc 06 00 00 00 00 00 - 18 fc 06 00 f8 fc 06 00 ................
0006fc50 f8 fc 06 00 b4 f0 e8 77 - 40 66 e7 77 ff ff ff ff .......w@f.w....
0006fc60 8c fc 06 00 35 01 36 79 - 30 00 00 00 38 fd 06 00 ....5.6y0...8...
0006fc70 16 02 00 00 88 fc 06 00 - 00 00 00 00 00 00 00 00 ................
0006fc80 38 fd 06 00 00 00 00 00 - 00 00 00 00 08 fd 06 00 8...............
0006fc90 bb ff 35 79 30 00 00 00 - 38 fd 06 00 16 02 00 00 ..5y0...8.......
0006fca0 c4 fc 06 00 44 f9 06 00 - 00 00 00 00 00 f0 fd 7f ....D...........
0006fcb0 41 c0 d2 77 e8 3a 07 00 - 4c fd 06 00 00 00 00 00 A..w.:..L.......
0006fcc0 f4 fc 06 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0006fcd0 b8 54 07 00 c0 4f 07 00 - 20 02 00 00 70 00 65 00 .T...O.. ...p.e.
0006fce0 34 00 00 00 01 00 00 00 - e9 02 36 79 00 00 00 00 4.........6y....
0006fcf0 a4 fc 06 00 e8 3a 07 00 - 58 ff 06 00 8e 13 36 79 .....:..X.....6y
0006fd00 b0 04 36 79 ff ff ff ff - 68 ff 06 00 ca fc 35 79 ..6y....h.....5y
0006fd10 30 00 00 00 38 fd 06 00 - 16 02 00 00 44 f9 06 00 0...8.......D...
0006fd20 5c c3 8c 77 00 f0 fd 7f - 00 00 23 00 20 38 23 00 \..w......#. 8#.

Statusabbild für Threadkennung 0x220

eax=77f75b39 ebx=00000000 ecx=0000021e edx=00000000 esi=77894086 edi=00000074
eip=77894091 esp=0028ff60 ebp=0028ff84 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000246


Funktion: ZwWaitForSingleObject
77894086 b8ea000000 mov eax,0xea
7789408b 8d542404 lea edx,[esp+0x4] ss:00aa9e47=????????
7789408f cd2e int 2e
77894091 c20c00 ret 0xc
77894094 8a5001 mov dl,[eax+0x1] ds:7878fa1f=??
77894097 3a5101 cmp dl,[ecx+0x1] ds:0081a104=00
7789409a 0f8598c7ffff jne RtlEqualPrefixSid+0x44 (77890838)
778940a0 84d2 test dl,dl
778940a2 7410 jz RtlQueryAtomInAtomTable+0x31 (77894fb4)
778940a4 0fb6d2 movzx edx,dl
778940a7 33ff xor edi,edi
778940a9 8d72ff lea esi,[edx+0xff] ds:00819ee6=00000000
778940ac 85f6 test esi,esi
778940ae 0f8f04100100 jnle RtlEraseUnicodeString+0x4e (778a50b8)
778940b4 b001 mov al,0x1

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
0028FF84 77E81B1B 00000074 FFFFFFFF 00000000 010012DF ntdll!ZwWaitForSingleObject
0028FFEC 00000000 00000000 00000000 00000000 00000000 kernel32!WaitForSingleObject

Statusabbild für Threadkennung 0x224

eax=00000000 ebx=00015f90 ecx=00000000 edx=00000000 esi=00075008 edi=00015f90
eip=7788beb2 esp=002cfebc ebp=002cfee4 iopl=0 nv up ei ng nz ac po cy
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000297


Funktion: NtRemoveIoCompletion
7788bea7 b8a8000000 mov eax,0xa8
7788beac 8d542404 lea edx,[esp+0x4] ss:00ae9da3=????????
7788beb0 cd2e int 2e
7788beb2 c21400 ret 0x14

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
002CFEE4 77D257C0 00000040 002CFF1C 002CFF0C 002CFF14 ntdll!NtRemoveIoCompletion
002CFF20 77D42899 00015F90 002CFF60 002CFF5C 002CFF70 rpcrt4!UuidFromStringA
002CFF74 77D42778 77D2DD59 00075008 0028FAF2 7788C277 rpcrt4!I_RpcTransConnectionReallocPacket
002CFFA8 77D2DD0B 00077D78 002CFFEC 77E7987C 00077DA0 rpcrt4!I_RpcTransConnectionReallocPacket
002CFFB4 77E7987C 00077DA0 0028FAF2 7788C277 00077DA0 rpcrt4!RpcBindingSetOption
002CFFEC 00000000 00000000 00000000 00000000 00000000 kernel32!SetThreadExecutionState

Statusabbild für Threadkennung 0x228

eax=00000000 ebx=00015f90 ecx=0100b2b0 edx=00000000 esi=00075008 edi=00015f90
eip=7788beb2 esp=0030febc ebp=0030fee4 iopl=0 nv up ei ng nz ac po cy
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000297


Funktion: NtRemoveIoCompletion
7788bea7 b8a8000000 mov eax,0xa8
7788beac 8d542404 lea edx,[esp+0x4] ss:00b29da3=????????
7788beb0 cd2e int 2e
7788beb2 c21400 ret 0x14

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
0030FEE4 77D257C0 00000044 0030FF1C 0030FF0C 0030FF14 ntdll!NtRemoveIoCompletion
0030FF20 77D42899 00015F90 0030FF60 0030FF5C 0030FF70 rpcrt4!UuidFromStringA
0030FF74 77D42778 77D2DDED 00075008 77891B34 77D2DCF3 rpcrt4!I_RpcTransConnectionReallocPacket
0030FFA8 77D2DD0B 00073E90 0030FFEC 77E7987C 00077F48 rpcrt4!I_RpcTransConnectionReallocPacket
0030FFB4 77E7987C 00077F48 77891B34 77D2DCF3 00077F48 rpcrt4!RpcBindingSetOption
0030FFEC 00000000 00000000 00000000 00000000 00000000 kernel32!SetThreadExecutionState

Statusabbild für Threadkennung 0x230

eax=77f4725f ebx=0007a334 ecx=7ffd9000 edx=00000000 esi=00078324 edi=0100b3c0
eip=77f4726a esp=007dff80 ebp=77889134 iopl=0 nv up ei ng nz ac po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000296


Funktion: GdiGetSpoolMessage
77f4725f b8c2100000 mov eax,0x10c2
77f47264 8d542404 lea edx,[esp+0x4] ss:00ff9e67=????????
77f47268 cd2e int 2e
77f4726a c21000 ret 0x10

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
77889134 4AFFC033 58850F08 890000C1 FFF00C42 8D0F044A gdi32!GdiGetSpoolMessage
0424548B 00000000 00000000 00000000 00000000 00000000 <nosymbols>

Statusabbild für Threadkennung 0x2d0

eax=00000000 ebx=80020000 ecx=0009bd58 edx=00000000 esi=0008b9b8 edi=0008b9f8
eip=778839c7 esp=0081fe28 ebp=0081ff74 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000202


Funktion: NtReplyWaitReceivePortEx
778839bc b8ac000000 mov eax,0xac
778839c1 8d542404 lea edx,[esp+0x4] ss:01039d0f=????????
778839c5 cd2e int 2e
778839c7 c21400 ret 0x14
778839ca 8b4710 mov eax,[edi+0x10] ds:008a58de=????????
778839cd 8b483c mov ecx,[eax+0x3c] ds:00819ee6=00000000
778839d0 f6400801 test byte ptr [eax+0x8],0x1 ds:00819ee6=00
778839d4 7502 jnz RtlCreateProcessParameters+0xd (77883cd8)
778839d6 03c8 add ecx,eax
778839d8 894de4 mov [ebp+0xe4],ecx ss:01039e5a=????????
778839db 8b4710 mov eax,[edi+0x10] ds:008a58de=????????
778839de 668b4038 mov ax,[eax+0x38] ds:00819ee7=0000
778839e2 668945e0 mov [ebp+0xe0],ax ss:01039e5b=????
778839e6 668945e2 mov [ebp+0xe2],ax ss:01039e5b=????
778839ea 53 push ebx

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
0081FF74 77D2D9DB 77D2DDED 0008B9B8 00000000 00000000 ntdll!NtReplyWaitReceivePortEx
0081FFA8 77D2DD0B 00073E90 0081FFEC 77E7987C 0007A740 rpcrt4!RpcBindingSetOption
0081FFB4 77E7987C 0007A740 00000000 00000000 0007A740 rpcrt4!RpcBindingSetOption
0081FFEC 00000000 77D2DCF3 0007A740 00000000 000000C8 kernel32!SetThreadExecutionState

*----> Raw Stack Dump <----*
0081fe28 ac db d2 77 84 03 00 00 - 54 ff 81 00 00 00 00 00 ...w....T.......
0081fe38 58 aa 07 00 00 00 00 00 - 18 3e 07 00 f8 82 07 00 X........>......
0081fe48 34 91 88 77 00 00 00 00 - 48 00 60 00 00 00 00 00 4..w....H.`.....
0081fe58 1c 02 00 00 f8 02 00 00 - 00 00 00 00 00 00 00 00 ................
0081fe68 02 00 01 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0081fe78 00 00 00 00 00 00 00 00 - 00 00 00 00 01 00 00 00 ................
0081fe88 01 00 00 00 00 00 00 00 - 14 00 00 00 01 01 01 01 ................
0081fe98 01 01 01 01 01 01 01 01 - 01 01 01 01 01 01 01 01 ................
0081fea8 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0081feb8 00 00 00 00 dd 51 06 80 - 00 00 00 00 00 00 00 00 .....Q..........
0081fec8 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0081fed8 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0081fee8 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0081fef8 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0081ff08 00 00 00 00 ff ff ff ff - 00 00 00 00 00 00 00 00 ................
0081ff18 e0 24 23 85 00 70 e9 85 - 00 80 e9 85 00 00 00 00 .$#..p..........
0081ff28 4f 4c 06 80 08 00 00 00 - 00 47 4e 85 e0 24 23 85 OL.......GN..$#.
0081ff38 00 00 00 00 4c 25 23 85 - e0 24 23 85 70 26 23 85 ....L%#..$#.p&#.
0081ff48 21 c3 42 80 e0 24 23 85 - 40 26 23 85 00 00 02 80 !.B..$#.@&#.....
0081ff58 00 a2 2f 4d ff ff ff ff - 50 fe 81 00 00 00 02 80 ../M....P.......

Statusabbild für Threadkennung 0x2d4

eax=00000000 ebx=00000004 ecx=00071eac edx=00000000 esi=77893233 edi=00000004
eip=7789323e esp=00cbfd24 ebp=00cbfd70 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000246


Funktion: NtWaitForMultipleObjects
77893233 b8e9000000 mov eax,0xe9
77893238 8d542404 lea edx,[esp+0x4] ss:014d9c0b=????????
7789323c cd2e int 2e
7789323e c21400 ret 0x14

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
00CBFD70 77E8ABFB 00CBFD48 00000001 00000000 00000000 ntdll!NtWaitForMultipleObjects
00CBFFB4 77E7987C 00000005 000B000A 793502A7 0007C878 kernel32!WaitForMultipleObjects
00CBFFEC 00000000 778221FE 0007C878 00000000 000000C8 kernel32!SetThreadExecutionState

*----> Raw Stack Dump <----*
00cbfd24 d7 bd e7 77 04 00 00 00 - 48 fd cb 00 01 00 00 00 ...w....H.......
00cbfd34 00 00 00 00 00 00 00 00 - 01 00 00 00 78 c8 07 00 ............x...
00cbfd44 01 00 00 00 04 01 00 00 - 08 01 00 00 1c 01 00 00 ................
00cbfd54 b4 01 00 00 68 ba 06 bf - 43 fe 44 80 39 51 41 80 ....h...C.D.9QA.
00cbfd64 e8 79 3b e1 ec 79 3b e1 - 40 31 e8 85 b4 ff cb 00 .y;..y;.@1......
00cbfd74 fb ab e8 77 48 fd cb 00 - 01 00 00 00 00 00 00 00 ...wH...........
00cbfd84 00 00 00 00 00 00 00 00 - b2 22 82 77 04 00 00 00 .........".w....
00cbfd94 b0 fe cb 00 00 00 00 00 - ff ff ff ff 78 c8 07 00 ............x...
00cbfda4 a7 02 35 79 0a 00 0b 00 - cc e6 35 e1 40 31 e8 85 ..5y......5.@1..
00cbfdb4 00 00 00 00 00 00 00 00 - 01 00 00 00 38 00 00 00 ............8...
00cbfdc4 23 00 00 00 23 00 00 00 - 0a 00 0b 00 a7 02 35 79 #...#.........5y
00cbfdd4 78 c8 07 00 68 02 35 79 - 4c 00 00 00 fe 21 82 77 x...h.5yL....!.w
00cbfde4 f8 8b fd 7f 24 98 e7 77 - 1b 00 00 00 00 02 00 00 ....$..w........
00cbfdf4 fc ff cb 00 23 00 00 00 - 84 f6 44 80 59 56 45 80 ....#.....D.YVE.
00cbfe04 80 bb 06 bf c8 a5 22 85 - c8 a5 22 85 40 00 00 00 ......"...".@...
00cbfe14 24 bb 06 bf 43 fe 44 80 - 39 51 41 80 c8 a5 22 85 $...C.D.9QA...".
00cbfe24 00 00 00 00 88 42 4e 85 - 0f 26 49 80 88 42 4e 85 .....BN..&I..BN.
00cbfe34 d8 00 00 00 c0 77 e8 85 - 03 00 10 00 c8 a5 22 85 .....w........".
00cbfe44 c0 77 e8 85 e0 a5 22 85 - c8 a5 22 85 cc a5 22 85 .w...."..."...".
00cbfe54 88 42 4e 85 01 00 00 00 - 00 47 4e 85 01 00 00 00 .BN......GN.....

Statusabbild für Threadkennung 0x2d8

eax=00481e60 ebx=00000002 ecx=00000000 edx=00000000 esi=77893233 edi=00000002
eip=7789323e esp=00d1f838 ebp=00d1f884 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246


Funktion: NtWaitForMultipleObjects
77893233 b8e9000000 mov eax,0xe9
77893238 8d542404 lea edx,[esp+0x4] ss:0153971f=????????
7789323c cd2e int 2e
7789323e c21400 ret 0x14

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
00D1F884 77E03990 00D1F85C 00000001 00000000 00000000 ntdll!NtWaitForMultipleObjects
00D1F8E0 77E03A5C 00D1F8AC 00D1F928 FFFFFFFF 000000FF user32!MsgWaitForMultipleObjectsEx
00D1F8FC 76A41F29 00000001 00D1F928 00000000 FFFFFFFF user32!MsgWaitForMultipleObjects
FFFFFFFF 00000000 00000000 00000000 00000000 00000000 spoolss!CacheCreateAndAddNode

*----> Raw Stack Dump <----*
00d1f838 d7 bd e7 77 02 00 00 00 - 5c f8 d1 00 01 00 00 00 ...w....\.......
00d1f848 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
00d1f858 02 00 00 00 64 01 00 00 - dc 01 00 00 00 00 00 00 ....d...........
00d1f868 70 f8 d1 00 00 00 00 00 - 70 f8 d1 00 70 f8 d1 00 p.......p...p...
00d1f878 30 1f 07 00 b4 f8 d1 00 - 00 f0 fd 7f e0 f8 d1 00 0...............
00d1f888 90 39 e0 77 5c f8 d1 00 - 01 00 00 00 00 00 00 00 .9.w\...........
00d1f898 00 00 00 00 00 00 00 00 - 94 55 e8 77 43 35 01 00 .........U.wC5..
00d1f8a8 00 00 00 00 64 01 00 00 - dc 01 00 00 00 00 31 78 ....d.........1x
00d1f8b8 40 f9 d1 00 e8 22 a4 76 - af 84 e2 77 00 00 31 78 @....".v...w..1x
00d1f8c8 00 00 00 00 38 bc 08 00 - 00 00 00 00 cc 66 fd 7f ....8........f..
00d1f8d8 00 00 00 00 dc 01 00 00 - fc f8 d1 00 5c 3a e0 77 ............\:.w
00d1f8e8 ac f8 d1 00 28 f9 d1 00 - ff ff ff ff ff 00 00 00 ....(...........
00d1f8f8 00 00 00 00 ff ff ff ff - 29 1f a4 76 01 00 00 00 ........)..v....
00d1f908 28 f9 d1 00 00 00 00 00 - ff ff ff ff ff 00 00 00 (...............
00d1f918 13 24 35 79 01 00 00 00 - b4 ff d1 00 00 00 00 00 .$5y............
00d1f928 64 01 00 00 00 00 00 00 - f8 7f ed 00 01 00 00 00 d...............
00d1f938 01 00 00 00 00 00 00 00 - 01 00 00 00 b4 ff d1 00 ................
00d1f948 6e 15 a4 76 00 00 00 00 - 00 00 00 00 e0 61 07 00 n..v.........a..
00d1f958 69 00 6e 00 65 00 74 00 - 70 00 70 00 2e 00 64 00 i.n.e.t.p.p...d.
00d1f968 6c 00 6c 00 00 00 6c 00 - 00 00 00 00 00 00 00 00 l.l...l.........

Statusabbild für Threadkennung 0x22c

eax=000006a6 ebx=00000001 ecx=00d5ffdc edx=00000000 esi=77893233 edi=00000001
eip=7789323e esp=00d5ff0c ebp=00d5ff58 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246


Funktion: NtWaitForMultipleObjects
77893233 b8e9000000 mov eax,0xe9
77893238 8d542404 lea edx,[esp+0x4] ss:01579df3=????????
7789323c cd2e int 2e
7789323e c21400 ret 0x14

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
00D5FF58 77E8ABFB 00D5FF30 00000001 00000000 00000000 ntdll!NtWaitForMultipleObjects
00D5FFB4 77E7987C 0000014C 00000000 00000000 00233D08 kernel32!WaitForMultipleObjects
00D5FFEC 00000000 76A41793 00233D08 00000000 00018003 kernel32!SetThreadExecutionState

*----> Raw Stack Dump <----*
00d5ff0c d7 bd e7 77 01 00 00 00 - 30 ff d5 00 01 00 00 00 ...w....0.......
00d5ff1c 00 00 00 00 00 00 00 00 - 00 00 00 00 08 3d 23 00 .............=#.
00d5ff2c 00 00 00 00 7c 01 00 00 - dc ff d5 00 b4 f0 e8 77 ....|..........w
00d5ff3c c0 d6 e8 77 ff ff ff ff - 78 ff d5 00 16 19 31 77 ...w....x.....1w
00d5ff4c 4c 01 00 00 38 00 12 00 - 00 00 00 00 b4 ff d5 00 L...8...........
00d5ff5c fb ab e8 77 30 ff d5 00 - 01 00 00 00 00 00 00 00 ...w0...........
00d5ff6c 00 00 00 00 00 00 00 00 - f7 17 a4 76 01 00 00 00 ...........v....
00d5ff7c a8 ff d5 00 00 00 00 00 - ff ff ff ff 00 00 00 00 ................
00d5ff8c 00 00 00 00 08 3d 23 00 - 03 01 00 00 00 00 00 00 .....=#.........
00d5ff9c 00 00 00 00 00 00 00 00 - 7c 01 00 00 7c 01 00 00 ........|...|...
00d5ffac 00 00 00 00 e6 11 a5 76 - ec ff d5 00 7c 98 e7 77 .......v....|..w
00d5ffbc 4c 01 00 00 00 00 00 00 - 00 00 00 00 08 3d 23 00 L............=#.
00d5ffcc 00 a0 fd 7f 00 00 00 00 - c0 ff d5 00 00 00 00 00 ................
00d5ffdc ff ff ff ff b4 f0 e8 77 - 60 d3 e7 77 00 00 00 00 .......w`..w....
00d5ffec 00 00 00 00 00 00 00 00 - 93 17 a4 76 08 3d 23 00 ...........v.=#.
00d5fffc 00 00 00 00 03 80 01 00 - 20 f9 07 00 03 80 00 00 ........ .......
00d6000c c0 86 16 00 03 80 01 00 - b8 e8 09 00 70 00 d6 00 ............p...
00d6001c 00 00 00 00 03 00 00 00 - 88 7b 0d 00 03 00 01 00 .........{......
00d6002c d0 9b 16 00 03 00 01 00 - a8 44 13 00 03 00 02 00 .........D......
00d6003c 88 66 0c 00 48 00 d6 00 - 00 00 00 00 50 00 d6 00 .f..H.......P...

Statusabbild für Threadkennung 0x2ec

eax=770f06ff ebx=77e8ac6e ecx=00d1eed0 edx=00000000 esi=77889153 edi=011eff80
eip=7788915e esp=011eff6c ebp=011eff88 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000202


Funktion: ZwDelayExecution
77889153 b832000000 mov eax,0x32
77889158 8d542404 lea edx,[esp+0x4] ss:01a09e53=????????
7788915c cd2e int 2e
7788915e c20800 ret 0x8

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
011EFF88 77E8AC79 00CA54E0 00000000 770F0727 00CA54E0 ntdll!ZwDelayExecution
011EFFB4 77E7987C 00ED6680 00000000 77E7A4E1 00ED6680 kernel32!Sleep
011EFFEC 00000000 00000000 00000000 00000000 00000000 kernel32!SetThreadExecutionState

Statusabbild für Threadkennung 0x2f0

eax=00ee1fe8 ebx=00000000 ecx=00ed55d8 edx=00000000 esi=77894086 edi=000001bc
eip=77894091 esp=0122ff64 ebp=0122ff88 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000246


Funktion: ZwWaitForSingleObject
77894086 b8ea000000 mov eax,0xea
7789408b 8d542404 lea edx,[esp+0x4] ss:01a49e4b=????????
7789408f cd2e int 2e
77894091 c20c00 ret 0xc
77894094 8a5001 mov dl,[eax+0x1] ds:016fbece=??
77894097 3a5101 cmp dl,[ecx+0x1] ds:016ef4be=??
7789409a 0f8598c7ffff jne RtlEqualPrefixSid+0x44 (77890838)
778940a0 84d2 test dl,dl
778940a2 7410 jz RtlQueryAtomInAtomTable+0x31 (77894fb4)
778940a4 0fb6d2 movzx edx,dl
778940a7 33ff xor edi,edi
778940a9 8d72ff lea esi,[edx+0xff] ds:00819ee6=00000000
778940ac 85f6 test esi,esi
778940ae 0f8f04100100 jnle RtlEraseUnicodeString+0x4e (778a50b8)
778940b4 b001 mov al,0x1

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
0122FF88 77E81B1B 000001BC FFFFFFFF 00000000 770D303B ntdll!ZwWaitForSingleObject
0122FFB4 77E7987C 00CD2120 00000000 00D1F320 00CD2120 kernel32!WaitForSingleObject
0122FFEC 00000000 00000000 00000000 00000000 00000000 kernel32!SetThreadExecutionState

Statusabbild für Threadkennung 0x320

eax=00000000 ebx=00000002 ecx=018dfb2c edx=00000000 esi=77893233 edi=00000002
eip=7789323e esp=018dff24 ebp=018dff70 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000246


Funktion: NtWaitForMultipleObjects
77893233 b8e9000000 mov eax,0xe9
77893238 8d542404 lea edx,[esp+0x4] ss:020f9e0b=????????
7789323c cd2e int 2e
7789323e c21400 ret 0x14

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
018DFF70 77E8ABFB 018DFF48 00000001 00000000 00000000 ntdll!NtWaitForMultipleObjects
00000000 00000000 00000000 00000000 00000000 00000000 kernel32!WaitForMultipleObjects

*----> Raw Stack Dump <----*
018dff24 d7 bd e7 77 02 00 00 00 - 48 ff 8d 01 01 00 00 00 ...w....H.......
018dff34 00 00 00 00 00 00 00 00 - 58 0b 0b 00 50 7a 0a 00 ........X...Pz..
018dff44 01 00 00 00 a4 03 00 00 - f4 03 00 00 00 00 00 00 ................
018dff54 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
018dff64 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
018dff74 fb ab e8 77 48 ff 8d 01 - 01 00 00 00 00 00 00 00 ...wH...........
018dff84 00 00 00 00 00 00 00 00 - a6 3b e3 00 02 00 00 00 .........;......
018dff94 b0 ff 8d 01 00 00 00 00 - ff ff ff ff 08 08 07 00 ................
018dffa4 08 00 00 00 ec ff 8d 01 - 58 0b 0b 00 a4 03 00 00 ........X.......
018dffb4 f4 03 00 00 7c 98 e7 77 - 58 0b 0b 00 08 08 07 00 ....|..wX.......
018dffc4 08 00 00 00 58 0b 0b 00 - 00 b0 fa 7f 00 02 00 00 ....X...........
018dffd4 c0 ff 8d 01 00 02 00 00 - ff ff ff ff b4 f0 e8 77 ...............w
018dffe4 60 d3 e7 77 00 00 00 00 - 00 00 00 00 00 00 00 00 `..w............
018dfff4 70 3b e3 00 58 0b 0b 00 - 00 00 00 00 4d 5a 90 00 p;..X.......MZ..
018e0004 03 00 00 00 04 00 00 00 - ff ff 00 00 b8 00 00 00 ................
018e0014 00 00 00 00 40 00 00 00 - 00 00 00 00 00 00 00 00 ....@...........
018e0024 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
018e0034 00 00 00 00 00 00 00 00 - d8 00 00 00 0e 1f ba 0e ................
018e0044 00 b4 09 cd 21 b8 01 4c - cd 21 54 68 69 73 20 70 ....!..L.!This p
018e0054 72 6f 67 72 61 6d 20 63 - 61 6e 6e 6f 74 20 62 65 rogram cannot be

Statusabbild für Threadkennung 0x9a8

eax=00000000 ebx=0000000b ecx=00000000 edx=00000000 esi=77893233 edi=0000000b
eip=7789323e esp=046df9cc ebp=046dfa18 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000246


Funktion: NtWaitForMultipleObjects
77893233 b8e9000000 mov eax,0xe9
77893238 8d542404 lea edx,[esp+0x4] ss:04ef98b3=????????
7789323c cd2e int 2e
7789323e c21400 ret 0x14

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
046DFA18 770EB033 0009C850 00000001 00000000 00000000 ntdll!NtWaitForMultipleObjects
046DFFB4 77E7987C 00ED1450 0465F49C 00000000 00ED1450 localspl!SplCopyFileEvent
046DFFEC 00000000 00000000 00000000 00000000 00000000 kernel32!SetThreadExecutionState

*----> Raw Stack Dump <----*
046df9cc d7 bd e7 77 0b 00 00 00 - 50 c8 09 00 01 00 00 00 ...w....P.......
046df9dc 01 00 00 00 00 00 00 00 - 28 00 00 00 00 00 00 00 ........(.......
046df9ec 01 00 00 00 4a d0 88 77 - 03 01 00 00 24 fa 6d 04 ....J..w....$.m.
046df9fc 0d bc e7 77 e5 03 00 00 - 04 ff 6d 04 94 9a e7 77 ...w......m....w
046dfa0c 03 01 00 00 24 00 00 00 - 00 00 00 00 b4 ff 6d 04 ....$.........m.
046dfa1c 33 b0 0e 77 50 c8 09 00 - 01 00 00 00 00 00 00 00 3..wP...........
046dfa2c 00 00 00 00 01 00 00 00 - 9c f4 65 04 00 00 00 00 ..........e.....
046dfa3c 50 14 ed 00 5c 00 5c 00 - 2e 00 5c 00 50 00 69 00 P...\.\...\.P.i.
046dfa4c 70 00 65 00 5c 00 53 00 - 70 00 6f 00 6f 00 6c 00 p.e.\.S.p.o.o.l.
046dfa5c 65 00 72 00 5c 00 4c 00 - 50 00 54 00 31 00 00 00 e.r.\.L.P.T.1...
046dfa6c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
046dfa7c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
046dfa8c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
046dfa9c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
046dfaac 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
046dfabc 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
046dfacc 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
046dfadc 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
046dfaec 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
046dfafc 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................

Statusabbild für Threadkennung 0xb08

eax=000006c0 ebx=00015f90 ecx=00000090 edx=00000000 esi=00075008 edi=00015f90
eip=7788beb2 esp=0489febc ebp=0489fee4 iopl=0 nv up ei ng nz ac po cy
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000297


Funktion: NtRemoveIoCompletion
7788bea7 b8a8000000 mov eax,0xa8
7788beac 8d542404 lea edx,[esp+0x4] ss:050b9da3=????????
7788beb0 cd2e int 2e
7788beb2 c21400 ret 0x14

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
0489FEE4 77D257C0 00000048 0489FF1C 0489FF0C 0489FF14 ntdll!NtRemoveIoCompletion
0489FF20 77D42899 00015F90 0489FF60 0489FF5C 0489FF70 rpcrt4!UuidFromStringA
0489FF74 77D42778 77D2DDED 00075008 FFFFFFFE 00000005 rpcrt4!I_RpcTransConnectionReallocPacket
0489FFA8 77D2DD0B 00073E90 0489FFEC 77E7987C 0009BEC0 rpcrt4!I_RpcTransConnectionReallocPacket
0489FFB4 77E7987C 0009BEC0 FFFFFFFE 00000005 0009BEC0 rpcrt4!RpcBindingSetOption
0489FFEC 00000000 00000000 00000000 00000000 00000000 kernel32!SetThreadExecutionState

Statusabbild für Threadkennung 0xa8c

eax=000c6ad8 ebx=77889134 ecx=000c6b08 edx=00000000 esi=03eb7fa0 edi=00073e18
eip=7788915e esp=021cff78 ebp=021cffa8 iopl=0 nv up ei ng nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000286


Funktion: ZwDelayExecution
77889153 b832000000 mov eax,0x32
77889158 8d542404 lea edx,[esp+0x4] ss:029e9e5f=????????
7788915c cd2e int 2e
7788915e c20800 ret 0x8

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
021CFFA8 77D2DD0B 00073E90 021CFFEC 77E7987C 03E50A78 ntdll!ZwDelayExecution
021CFFB4 77E7987C 03E50A78 00000004 00000000 03E50A78 rpcrt4!RpcBindingSetOption
021CFFEC 00000000 00000000 00000000 00000000 00000000 kernel32!SetThreadExecutionState

Statusabbild für Threadkennung 0xa50

eax=00000000 ebx=00015f90 ecx=000c6a0c edx=00000000 esi=00075008 edi=00015f90
eip=7788beb2 esp=0220febc ebp=0220fee4 iopl=0 nv up ei ng nz ac po cy
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000297


Funktion: NtRemoveIoCompletion
7788bea7 b8a8000000 mov eax,0xa8
7788beac 8d542404 lea edx,[esp+0x4] ss:02a29da3=????????
7788beb0 cd2e int 2e
7788beb2 c21400 ret 0x14

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
0220FEE4 77D257C0 0000004C 0220FF1C 0220FF0C 0220FF14 ntdll!NtRemoveIoCompletion
0220FF20 77D42899 00015F90 0220FF60 0220FF5C 0220FF70 rpcrt4!UuidFromStringA
0220FF74 77D42778 77D2DDED 00075008 021CF9A8 00000000 rpcrt4!I_RpcTransConnectionReallocPacket
0220FFA8 77D2DD0B 00073E90 0220FFEC 77E7987C 000F8798 rpcrt4!I_RpcTransConnectionReallocPacket
0220FFB4 77E7987C 000F8798 021CF9A8 00000000 000F8798 rpcrt4!RpcBindingSetOption
0220FFEC 00000000 00000000 00000000 00000000 00000000 kernel32!SetThreadExecutionState

Statusabbild für Threadkennung 0xb68

eax=0268ed7c ebx=866d0002 ecx=00000000 edx=00000000 esi=00076808 edi=000a6e68
eip=778839c7 esp=0268fe28 ebp=0268ff74 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000206


Funktion: NtReplyWaitReceivePortEx
778839bc b8ac000000 mov eax,0xac
778839c1 8d542404 lea edx,[esp+0x4] ss:02ea9d0f=????????
778839c5 cd2e int 2e
778839c7 c21400 ret 0x14
778839ca 8b4710 mov eax,[edi+0x10] ds:008c0d4e=????????
778839cd 8b483c mov ecx,[eax+0x3c] ds:02ea8c62=????????
778839d0 f6400801 test byte ptr [eax+0x8],0x1 ds:02ea8c62=??
778839d4 7502 jnz RtlCreateProcessParameters+0xd (77883cd8)
778839d6 03c8 add ecx,eax
778839d8 894de4 mov [ebp+0xe4],ecx ss:02ea9e5a=????????
778839db 8b4710 mov eax,[edi+0x10] ds:008c0d4e=????????
778839de 668b4038 mov ax,[eax+0x38] ds:02ea8c63=????
778839e2 668945e0 mov [ebp+0xe0],ax ss:02ea9e5b=????
778839e6 668945e2 mov [ebp+0xe2],ax ss:02ea9e5b=????
778839ea 53 push ebx

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
0268FF74 77D2D9DB 77D2DDED 00076808 0220FAAC 77D2C3E6 ntdll!NtReplyWaitReceivePortEx
0268FFA8 77D2DD0B 00073E90 0268FFEC 77E7987C 000B0070 rpcrt4!RpcBindingSetOption
0268FFB4 77E7987C 000B0070 0220FAAC 77D2C3E6 000B0070 rpcrt4!RpcBindingSetOption
0268FFEC 00000000 00000000 00000000 00000000 00000000 kernel32!SetThreadExecutionState

Statusabbild für Threadkennung 0xadc

eax=00000003 ebx=77889134 ecx=7ffd4000 edx=00000000 esi=000bed98 edi=00073e18
eip=7788915e esp=0148ff78 ebp=0148ffa8 iopl=0 nv up ei ng nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000286


Funktion: ZwDelayExecution
77889153 b832000000 mov eax,0x32
77889158 8d542404 lea edx,[esp+0x4] ss:01ca9e5f=????????
7788915c cd2e int 2e
7788915e c20800 ret 0x8

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
0148FFA8 77D2DD0B 00073E90 0148FFEC 77E7987C 000FB1E0 ntdll!ZwDelayExecution
0148FFB4 77E7987C 000FB1E0 0220F9A8 00000000 000FB1E0 rpcrt4!RpcBindingSetOption
0148FFEC 00000000 00000000 00000000 00000000 00000000 kernel32!SetThreadExecutionState

Statusabbild für Threadkennung 0x914

eax=00000000 ebx=05b1ff7c ecx=000000b1 edx=00000000 esi=77894086 edi=00000168
eip=77894091 esp=05b1ff60 ebp=05b1ff84 iopl=0 nv up ei ng nz ac po cy
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000297


Funktion: ZwWaitForSingleObject
77894086 b8ea000000 mov eax,0xea
7789408b 8d542404 lea edx,[esp+0x4] ss:06339e47=????????
7789408f cd2e int 2e
77894091 c20c00 ret 0xc
77894094 8a5001 mov dl,[eax+0x1] ds:00819ee6=00
77894097 3a5101 cmp dl,[ecx+0x1] ds:00819f97=00
7789409a 0f8598c7ffff jne RtlEqualPrefixSid+0x44 (77890838)
778940a0 84d2 test dl,dl
778940a2 7410 jz RtlQueryAtomInAtomTable+0x31 (77894fb4)
778940a4 0fb6d2 movzx edx,dl
778940a7 33ff xor edi,edi
778940a9 8d72ff lea esi,[edx+0xff] ds:00819ee6=00000000
778940ac 85f6 test esi,esi
778940ae 0f8f04100100 jnle RtlEraseUnicodeString+0x4e (778a50b8)
778940b4 b001 mov al,0x1

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
05B1FF84 77E81B1B 00000168 000009C4 00000000 76A4C0A8 ntdll!ZwWaitForSingleObject
77889134 4AFFC033 58850F08 890000C1 FFF00C42 8D0F044A kernel32!WaitForSingleObject
0424548B 00000000 00000000 00000000 00000000 00000000 <nosymbols>

Statusabbild für Threadkennung 0x6d8

eax=76a4c039 ebx=05b5ff7c ecx=00cd0748 edx=00000000 esi=77894086 edi=00000168
eip=77894091 esp=05b5ff60 ebp=05b5ff84 iopl=0 nv up ei ng nz ac po cy
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000297


Funktion: ZwWaitForSingleObject
77894086 b8ea000000 mov eax,0xea
7789408b 8d542404 lea edx,[esp+0x4] ss:06379e47=????????
7789408f cd2e int 2e
77894091 c20c00 ret 0xc
77894094 8a5001 mov dl,[eax+0x1] ds:77265f1f=??
77894097 3a5101 cmp dl,[ecx+0x1] ds:014ea62e=??
7789409a 0f8598c7ffff jne RtlEqualPrefixSid+0x44 (77890838)
778940a0 84d2 test dl,dl
778940a2 7410 jz RtlQueryAtomInAtomTable+0x31 (77894fb4)
778940a4 0fb6d2 movzx edx,dl
778940a7 33ff xor edi,edi
778940a9 8d72ff lea esi,[edx+0xff] ds:00819ee6=00000000
778940ac 85f6 test esi,esi
778940ae 0f8f04100100 jnle RtlEraseUnicodeString+0x4e (778a50b8)
778940b4 b001 mov al,0x1

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
05B5FF84 77E81B1B 00000168 000009C4 00000000 76A4C0A8 ntdll!ZwWaitForSingleObject
77889134 4AFFC033 58850F08 890000C1 FFF00C42 8D0F044A kernel32!WaitForSingleObject
0424548B 00000000 00000000 00000000 00000000 00000000 <nosymbols>

Statusabbild für Threadkennung 0x728

eax=0745fdcd ebx=000c6688 ecx=03edc8b8 edx=07460020 esi=0746001c edi=00000b00
eip=06a62e0e esp=05b9e8ec ebp=00000001 iopl=0 nv up ei pl nz na pe cy
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000203


Funktion: <nosymbols>
06a62df0 8b542428 mov edx,[esp+0x28] ss:063b87d3=????????
06a62df4 8bc2 mov eax,edx
06a62df6 8b7c2424 mov edi,[esp+0x24] ss:063b87d3=????????
06a62dfa 2bc7 sub eax,edi
06a62dfc 8d3c3f lea edi,[edi+edi] ds:00000b00=????????
06a62dff 89442438 mov [esp+0x38],eax ss:063b87d3=????????
06a62e03 f7df neg edi
06a62e05 03fa add edi,edx
06a62e07 897c2408 mov [esp+0x8],edi ss:063b87d3=????????
06a62e0b 8b7afc mov edi,[edx+0xfc] ds:07c79f06=????????
FEHLER ->06a62e0e 3b78fc cmp edi,[eax+0xfc] ds:07c79cb3=????????
06a62e11 7507 jnz 06a6e81a
06a62e13 ba01000000 mov edx,0x1
06a62e18 eb02 jmp 06a6611c
06a62e1a 33d2 xor edx,edx
06a62e1c 85d2 test edx,edx
06a62e1e 7442 jz 06a6b962
06a62e20 8bd0 mov edx,eax
06a62e22 8d4a04 lea ecx,[edx+0x4] ds:07c79f06=????????
06a62e25 8b442408 mov eax,[esp+0x8] ss:063b87d3=????????
06a62e29 8d7804 lea edi,[eax+0x4] ds:07c79cb3=????????
06a62e2c 8b12 mov edx,[edx] ds:07460020=00000000

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
00000001 00000000 00000000 00000000 00000000 00000000 !<nosymbols>

*----> Raw Stack Dump <----*
05b9e8ec 68 ee b9 05 91 81 89 77 - 7a fb 45 07 ff ff ff ff h......wz.E.....
05b9e8fc 88 66 0c 00 00 00 07 00 - 50 e9 b9 05 b8 c8 ed 03 .f......P.......
05b9e90c a7 c8 88 77 53 02 00 00 - 20 00 46 07 42 e7 e8 77 ...wS... .F.B..w
05b9e91c 98 12 00 00 a6 04 00 00 - cd fd 45 07 10 00 00 00 ..........E.....
05b9e92c 00 00 00 00 54 e9 b9 05 - 00 01 00 00 00 00 00 00 ....T...........
05b9e93c ea 1a a6 06 80 f3 b9 05 - 88 66 0c 00 00 00 00 00 .........f......
05b9e94c 00 01 00 00 00 00 00 00 - 00 00 00 00 26 12 a6 06 ............&...
05b9e95c 6b 00 00 00 00 00 00 00 - 00 00 00 10 01 03 80 31 k..............1
05b9e96c 00 02 00 00 00 00 00 00 - 88 66 0c 00 00 00 00 14 .........f......
05b9e97c 00 00 01 00 00 00 12 98 - 00 00 00 00 00 01 00 00 ................
05b9e98c 01 00 00 00 00 01 00 00 - 20 00 46 07 02 00 00 00 ........ .F.....
05b9e99c 48 87 e9 03 e4 e9 b9 05 - 20 78 e9 03 20 00 46 07 H....... x.. .F.
05b9e9ac bd 15 3e 01 3c 00 d6 00 - 20 00 46 07 a6 04 00 00 ..>.<... .F.....
05b9e9bc 00 01 00 00 01 00 00 00 - 4c 09 00 00 53 02 00 00 ........L...S...
05b9e9cc 20 78 e9 03 00 00 00 00 - 01 00 00 00 00 00 00 00 x..............
05b9e9dc 00 00 00 00 54 13 3c 01 - 54 ea b9 05 d1 a1 3c 01 ....T.<.T.....<.
05b9e9ec 20 78 e9 03 00 00 00 03 - 00 00 00 00 00 00 00 00 x..............
05b9e9fc 00 00 00 00 00 00 6c 07 - 20 78 e9 03 00 00 00 00 ......l. x......
05b9ea0c 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
05b9ea1c 00 00 00 00 00 00 00 00 - 00 00 00 00 20 00 ac 06 ............ ...

Statusabbild für Threadkennung 0xbe4

eax=03edf000 ebx=866d0002 ecx=05fdf700 edx=00000000 esi=00076808 edi=000a6e68
eip=778839c7 esp=05fdfe28 ebp=05fdff74 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000202


Funktion: NtReplyWaitReceivePortEx
778839bc b8ac000000 mov eax,0xac
778839c1 8d542404 lea edx,[esp+0x4] ss:067f9d0f=????????
778839c5 cd2e int 2e
778839c7 c21400 ret 0x14
778839ca 8b4710 mov eax,[edi+0x10] ds:008c0d4e=????????
778839cd 8b483c mov ecx,[eax+0x3c] ds:046f8ee6=????????
778839d0 f6400801 test byte ptr [eax+0x8],0x1 ds:046f8ee6=??
778839d4 7502 jnz RtlCreateProcessParameters+0xd (77883cd8)
778839d6 03c8 add ecx,eax
778839d8 894de4 mov [ebp+0xe4],ecx ss:067f9e5a=????????
778839db 8b4710 mov eax,[edi+0x10] ds:008c0d4e=????????
778839de 668b4038 mov ax,[eax+0x38] ds:046f8ee7=????
778839e2 668945e0 mov [ebp+0xe0],ax ss:067f9e5b=????
778839e6 668945e2 mov [ebp+0xe2],ax ss:067f9e5b=????
778839ea 53 push ebx

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
05FDFF74 77D2D9DB 77D2DD59 00076808 0268FAAC 77D2C3E6 ntdll!NtReplyWaitReceivePortEx
05FDFFA8 77D2DD0B 001188D8 05FDFFEC 77E7987C 000B0D10 rpcrt4!RpcBindingSetOption
05FDFFB4 77E7987C 000B0D10 0268FAAC 77D2C3E6 000B0D10 rpcrt4!RpcBindingSetOption
05FDFFEC 00000000 00000000 00000000 00000000 00000000 kernel32!SetThreadExecutionState

Statusabbild für Threadkennung 0x1b8

eax=00e37c50 ebx=00000000 ecx=00000000 edx=00000000 esi=77894086 edi=000004d0
eip=77894091 esp=0601fa98 ebp=0601fabc iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000246


Funktion: ZwWaitForSingleObject
77894086 b8ea000000 mov eax,0xea
7789408b 8d542404 lea edx,[esp+0x4] ss:0683997f=????????
7789408f cd2e int 2e
77894091 c20c00 ret 0xc
77894094 8a5001 mov dl,[eax+0x1] ds:01651b36=??
77894097 3a5101 cmp dl,[ecx+0x1] ds:00819ee6=00
7789409a 0f8598c7ffff jne RtlEqualPrefixSid+0x44 (77890838)
778940a0 84d2 test dl,dl
778940a2 7410 jz RtlQueryAtomInAtomTable+0x31 (77894fb4)
778940a4 0fb6d2 movzx edx,dl
778940a7 33ff xor edi,edi
778940a9 8d72ff lea esi,[edx+0xff] ds:00819ee6=00000000
778940ac 85f6 test esi,esi
778940ae 0f8f04100100 jnle RtlEraseUnicodeString+0x4e (778a50b8)
778940b4 b001 mov al,0x1

*----> Stack Back Trace <----*

FramePtr ReturnAd Param#1 Param#2 Param#3 Param#4 Function Name
0601FABC 77E81B1B 000004D0 FFFFFFFF 00000000 00E37844 ntdll!ZwWaitForSingleObject
77E85594 F7028B7F AC0F0462 8BC318D0 B70F0443 0C8D1240 kernel32!WaitForSingleObject
FE0000BA 00000000 00000000 00000000 00000000 00000000 <nosymbols>

*----> Raw Stack Dump <----*
0601fa98 c2 c4 e8 77 d0 04 00 00 - 00 00 00 00 00 00 00 00 ...w............
0601faa8 4c fb 01 06 58 0b 0b 00 - 00 00 00 00 00 40 fa 7f L...X........@..
0601fab8 00 40 fa 7f 94 55 e8 77 - 1b 1b e8 77 d0 04 00 00 .@...U.w...w....
0601fac8 ff ff ff ff 00 00 00 00 - 44 78 e3 00 d0 04 00 00 ........Dx......
0601fad8 ff ff ff ff 6e ac e8 77 - 58 0b 0b 00 f5 7d e3 00 ....n..wX....}..
0601fae8 58 0b 0b 00 4c fb 01 06 - 00 00 00 00 00 00 00 00 X...L...........
0601faf8 ec ff 01 06 58 0b 0b 00 - 00 00 00 00 00 00 00 00 ....X...........
0601fb08 00 00 00 00 00 00 00 00 - a7 a4 6a 00 00 00 00 00 ..........j.....
0601fb18 00 00 00 00 01 00 00 00 - 00 00 00 00 02 00 00 00 ................
0601fb28 00 00 f8 76 00 00 00 00 - 00 00 00 00 00 00 00 00 ...v............
0601fb38 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................
0601fb48 68 00 00 00 58 0b 0b 00 - 00 fb 01 06 04 fb 01 06 h...X...........
0601fb58 18 fb 01 06 14 fb 01 06 - 10 fb 01 06 08 fb 01 06 ................
0601fb68 20 fb 01 06 0f fb 01 06 - 2c fb 01 06 98 fb 01 06 .......,.......
0601fb78 9c fb 01 06 34 fb 01 06 - 1c fb 01 06 30 fb 01 06 ....4.......0...
0601fb88 44 fb 01 06 28 fb 01 06 - 48 fb 01 06 a0 fb 01 06 D...(...H.......
0601fb98 02 00 00 00 00 00 00 00 - 00 00 00 00 02 00 00 00 ................
0601fba8 80 fc 01 06 00 00 9a 77 - 00 00 00 00 00 00 00 00 .......w........
0601fbb8 00 00 00 00 01 00 00 00 - 00 f0 fd 7f 74 fc 01 06 ............t...
0601fbc8 b2 18 4f 77 00 00 00 00 - 00 00 00 00 00 00 00 00 ..Ow............

3. Problem:

Wenn der Spoolerdienst des Servers bei den Druckern benutzt wird werden die Druckdaten der Clients nur ganz träge angenommen also ca. nur 1 MB pro Minute. Dementsprechend lange brauchen dann die Druckjobs.

4. Problem:

Abundzu (so 1 mal aller 2 Stunden) klemmt der Server, also Fenster in denen ich etwas machen möchte frieren einfach ein. Wenn ich dann ca 15 Minuten warte erholt er sich schlagartig und läuft wieder einwandfrei. Im Taskmanager konnte ich kein Programm finden was in dem Moment Ressourcen gefressen hätte.

Es wäre Klasse wenn ich von euch ein paar Lösungsansätze bekommen könnte, damit wenn ich wieder beim Kunden vor Ort bin wenigstens den Server stabil zum laufen bekomme. Er hat momentan nämlich das Problem das er täglich den Server neustarten muss da dieser sich wegklemmt.

Danke schon mal für eure Bemühungen.